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(54) . Control system for shaft drive assembly, 



(57) Control of a shaft drive assembly is effected using a pair pf micro control devices 1, 2. for control ling: fuel \ 
metering by means of a metering valve 10 with a stepping motor 8, and for.mpnitoring forshaft fracture and ' 
excessive rotational speed by means of sensors. The micro control devices 1> 2 can each carry out iboth,contror. 
and monitoring functions. In nornnal mode the first micro control device 1 is the selected control device, .-^i.r r 
controlling the stepping motor 8 vi^hile the second micro control device 2 as the auxiliary control device; : v r - •: 
monitors the permitted boundary data of the engine. The micro control devices are coupled in such a^way that . 
the control and monitoring functions can be svvitched over between the devices. In the event of a failure:of one 
of the control devices, the other can take over both control and monitoring functions. » 
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Shaft Drive Control 

The invention relates to the control of a shaft 
drive assembly or engine with at least one micro 
control device such as a microprocessor for controlling 
the metering of fuel by means of . a metering valve with 
a motor drive and/or channel cut-off logic,, with 
monitoring of th^e' engine for shafts f ractulre? and V- , ^y-^ 
excessive f:oiati6hal^Vspeed-l^^ :of sensprs.. ,y 

- Control' ' sysVem^r of v t^^ are' known and operate: 

typically ;with':'a •"i^^^ number , of micro control deyi'cesv- 
The :knowh 'f'cpntr'6li. devices use separate - micrp icpntrol 
de^/ices /for ' contr'oiling the supply of f uel^v^mgnitpring^^^ 
the rotational speed of ; the engine or the,- shaft , . Md^.--, r 
mdnitoring shaft fracture/ as well - as - -redundant micro.. 
control devices which> «as-- supplementary or auxiliary 
control; devices, doubie:.:.or^ -triple the. number .of . cpnj:r;9l 
deVipesiV^r^quired to 5ir'eduGe\ f uj^^^ the likelihooc^. of v. a-j 
malfunctioh :^of a- cbntr^ which is about lO^-i - — 

Even if micro ciontrpir devices this type are 
already minimised ihl volume Vand , weighs using them in 
quantities in an aircraft *^-raeans a. considerable space 
and weight requirement/ 

It has also not beein conclusively proved that a 
plurality of auxiliary micro control devices increases 
reliability; on the contrary, tests show that unused 
non-active auxiliary devices often fail to provide 
service at the decisive moment. A solution in this 
case is regular alternating use of the auxiliary 
devices and the main devices. This has the 
disadvantage that the auxiliary devices are 
intermittently inactive and still represent an 
additional space requirement and additional weight. 

A further disadvantage is that often the micro 
control devices with a monitoring function hatve the 
sole function of switching off the engine when 
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individual sensors indicate that limit values have been 
exceeded. This may lead to hasty and possibly 
catastrophic conclusions if the signals are incorrectly 
interpreted by a sensor. 
5 It is the aim of the invention to provide " a 

control system which manages with a reduced number of 
micro ^control devices/ reduces the likelihood of , y • - *• 
incorrect '^functioning, .can be used with great .economy "7 
1 tvv- of: space arid -weight , reduces **the : inadtive phaLses'iof 'tihe^ 
10 '^A? ' -micro control devie'eis>^;and ensures an opt iiiium cont^ ' 
\ of- shaft' drove -assembries : ; 7";^' • -^'^^ V •.•=^"''" ?' 

; / TC;/ ? This ainv^^dL;s \ achieved with - the control' -of a fshaft^i - 
- : - drive assembly with; at- least one . micro" control device^ .< 
- for ieontrol'li-iigrthe mSetering of f uel by mearis'rof .a r-. .'v 
15 - " metering valve, with a^ -motor driv^ and channel "cut -of f 
/ r^-.wi I'ogiic, with monitor iiig of the drive assembly for' /shaf t 
> vfracture and/or ^.excessive rotational spe^d, by ^.m^ of • • 
■^V: .'. V- i'sensorsV charadterised in x^ and- a 'second i.^.a^ 

Y ' .rVj^.'S xnicro cohtror ' device are joined ' together and locked /- 
.20 with respect to each other in partial functions , ^the 

-iMr^' f irst micro control device as tfiie selected control . s 
: device {control ling a stepping motor which operates the 
metering valve, and the second micro control device as 
the ^iixiliary control device monitoring the permitted 
25 boundary data of the drive assembly and is equipped 

with drivier outputs which according to the fault (fault 
in the control devices, shaft fracture, excessive 
rotational speed) freeze the stepping motor position by 
means of a first logic switch, or trigger a fast cut- 
30 off by means of a transistor driver with a second logic 

switch connected downstream, or make possible a delayed 
cut-off by means of the second logic switch, the 
selected and the auxiliary control device being coupled 
together by means of the first and second logic 
35 switches and an additional direct data line in such a 

way that the functions can be alternately switched over 
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according to the setting of the first and second logic 
switches . 

Two completely equivalent micro control devices 
are provided with completely equivalent functions but 
are not used simultaneously for the same function. . On 
the contrary, a first micro control device, controls the 
fuel . consumption, for instauice, whilst a. se.qpnd-inicro 

'vCon.ti:olj-'*deyice takes over, the monitoring;, ,funj;:,ti!9ins^^^^ . 

'Bpth;*:dey4!Q^sr are therefore- constant^ly^ i.^ . use , i .^^^ 

^,as .^the- 'Selected- control deyice fj^r ; .f uel, .adjxist^ 
the. other as i the, .auxiliary . device for all. the, rja.,:^ ; 
monitoring .functi^ In the case ..pf. total fail]ure piEr 

.-one;. of .the , devices the other; deyice can\ take oyeir- its^^^^ 
;f unct_ipns Provision is. also, advantagepufly, ma4e . £^ 

-.the devices to switch over, i.-, e... to. ,.e3?.change ftmctipns. 

: With,::~this concept , the like lih,opd^,pf_error to 

_-abput. iq*f ;-v^:-:' .r Z^,;-:- • . ' , . • 

: In . addition a.- first , and a. .second_^micrp control^;- . -.^ 
device are; preferably joined .together .and - Ip.c^^ witph . 
: respect, to each other in pa^^tial .functi^ 
v-micro control device acting ias/i th^^^ selected- 
fidevicp controls a stepping motor, which operates the 
metering valve. The second micro control device, 
act-.ing as the auxiliary control device, monitors the 
permitted boundary data of the engine and is equipped 
with driver outputs which freeze the stepping motor 
position by means of a first logic switch, or trigger a 
fast cut-off by means of a transistor driver with a 
second logic switch connected downstream, or in the 
case of excessive rotational speed make possible a 
delayed cut-off by means of the second logic switch. 
The selected and the auxiliary control device are 
coupled together by means of the first and second logic 
switches and an additional direct data line in such a 
way that the functions can be alternately switched over 
according to the position of the first and second logic 
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switches . 

This cont.rol concept not only increases the 
reliability of control and monitoring but is also cost- 
effective and reduces the weight cuid space requirement 
in an aircraft. 

' The invention is also directed to a method of 

- control ling a shaft drive assembly. - ^'''i-":::-: -.^ \ 
/>>'^ vcviii^^ embbdinieht of - the- invent iOii-^-tfiie' V 
• fast vcTat^-^:of f ^*is triggered by 'th€i:/auxi4iary';c 
^dfevicei 'and' effected by . select ed-':c6ntrol deA^ce. 

This *divis iori of work : has the' advantage- that i-mbriitbring 
for a 'f a^s%-cUt^of f can be carried: out in the auxiliary : 

/control :'^eVice at ^ shorter intervals or icycles tiianV 
standar'd t^st for shaft fracture which'^'is-^inan .in * 

' seiectedv thicro cdritrol device / whose: main -task -is .ftiel 
control'Vanci' runs -the shaft f racture-tes't /at-::16h^erl 'i 
intervals, or cycres. However; if; a 'shaft - fracture .of 
this kind 'is signalled by the f aster ^auxiliar^ contrb^^^^ 
device^ ' then the standard cycle in 'the'/selected rhicfcb 

.cbntrpi* "device is interrupted* by. :means of . the idat-a 

- sigriai line and directly thereaf ter, "tlie shkf tv.-^f racture 
'^t'est is carried out and on confirmation the(;.f kst 

cui-bff of the fuel supply is brought about'^^fay the 
selected micro control device. 

In a further preferred embodiment of the invention 
both micro control devices can carry out all the 
functions as individual devices during total failure of 
one control device, but the monitoring function for 
shaft rupture, in this case slowed down by the factor 
3 to 10, is carried out by only one device. This has 
the advantage that with reduced reliability (likelihood 
of error about 10"^) the engine is still fully 
functional with a single micro control device and all 
the monitoring and control functions are fulfilled - 
Moreover if the disadvantage of reduced reliability is 
permanently accepted then there can be a further 
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advantageous reduction in costs, space requirement and 
weight in omitting the second micro control device 
altogether. 

In a preferred control process, the operation is 
carried out with a main cycle at a cycle time of 
20.. to 100 milliseconds and with say four siib.-cycles 
with -.a -.control time t^ of 5 to 25 millise|Conds . ... AIL. the 
ipng^T^eJ^m vfuncti can be processed- in- ther-maihrj^^^ 
: andVi:l^he''l;shprt-term iCyc^^^ can^be accbmmodated .;in>^^.^.^^ - 
' siib;^ cydies . This ,: control ^concept . advantageous Ly^^:^^^^^^ - 
reduGesrjvthe .idle times -^and provides' greater s.tabi-lat^ 
• reserve^^vEpr^th devices^ ; -. f • j^V ; '^J^r' 

-vSha^4t^=rfracture >qnitoring belongs priefer^^ i-. 
;fchf5. :SLhor't-,tr*er^ cycles, operating"! with; cycle.^t:imesv;..ofr - 
- f rom tR/4 : t£6 tji/lO . : However, these , short-, cycle times- 
can only- ibe achieved in short secjuence by -means/^qf the 
: solution of: the • invention if the control and monitoriing 
: f unctipfis ar^^ f irst .;qf all carried; put; .-iby .,twq; . , . \ . 
■ sepax^ately^iworking^micro contra v ■. ^f.V^^ 

roypl^v:- times preferably of , tR/2,;^^^^ 2ta areJprpyided 
^\f;pjr/.mpnitoring overshoots of rptatipiial SReeci;,; since 
Jjthxs error requires no short- term, .ireact ion, j^;^^^ a 
shkft fracture. Before reactions are triggered, i.e. 
bef ore the selected micro control device is ^^interrupted 
by means of the data signal line, in order then to 
block the supply of fuel, the operation is carried out 
for the sake of safety with 3-to-5 fold confirmation. 

The different exertion of influence on the engine 
by co-operation of the micro control devices and the 
downstream logic switch is divided essentially into two 
cases - In one case the actual state of the fuel supply 
is frozen, i.e. it is neither increased nor decreased; 
in the other case the supply of fuel is cQDruptly 
blocked. In both cases, however, operators are given 
the possibility of operating the fuel supply manually. 
Provision is always made for freezing when 
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statistical errors occtxr in the sensor technology or 
the microelectronics, or when temporarily switching 
over from one micro control device to the other. 
Complete blocking of the fuel supply is necessary with 
sudden shaft fracture or with sustained excessive 
rotational speed. 

In another embodiment of the invention- the: 
stepping'^ motor is operated via four phase ^isu^ply": lines- 
wi th ' f dur phase s whi ch are ^ con t rol I'ed by* meedis : -of ^ a ■ ' 
drivfer, and four-pole switching ; selectively ;byr't^^^ 
orVthieV second micro control device when a selectibn . 
signal: is present at their outputs. : This ^method: of;.... 
bperatxon,' known in .principle, : has. the. advantage: :':in . 
'conjunction with the invention that. a . simple ; .cheap -.cuid 
easily dfistallable solution can be found for theVi. 
f reezihg ^'operation. Freezing of ' the position of the 
stepping? motor; and hence of the positionrof the/.:-.: w 
tnetering^valve, is preferably effected byvapplying a 
stop voltage of 12 to 48 V at one^of the phase supply 
lines; of ^ the stepping motor by means of relay /contacts 
in the first logic switch. ' - .• ">. : J •? 

• ■ With this logic switch, which has to ' be . located in 
'Sirbrit of the switch for change-over of the -functions of 
the" two control devices so that both one arid the other 
can exert the same influence on the engine when the 
functions .are swapped, an influence on the engine is 
not produced in every case when a faulty operation of 
the micro control devices themselves occurs. Therefore 
an error signal at one of the outputs of the micro 
control devices preferably causes freezing of the 
position of the stepping motor and hence the position 
of the metering valve by applying a stop voltage of 12 
to 48 V at one of the phase supply lines of the 
stepping motor by means of relay contacts of a third 
logic switch, this third logic switch being arranged 
after the switch-over device. 
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In the case of a fast cut-off upon shaft fracture 
the non- selected second micro control device as the 
auxiliary control device preferably interrupts the 
selected first micro control device in its main cycle 
by means of a signal line, and causes it to switch over 
to shaft fracture mode. After independent testing by 
the first micro control device and confirmation of the 
■"shaf't> fracture, an output signal is.igener4tedr at the 
Tfisrst micro control -device and vby mecms^qf - th^ second 
^aogic switch: switches off ithe ^ engine; by t< blocking the , , , ... 
^fu:el^;^etering valve: r-^f/ • • : - : trV^^fex^^r' :^ 

, .'^I'^^uThese sfolut ions ..for controlling . shaft .>power. drive- 
: assemblies ensure on . the one Vrhand^i that .thepe.^is.; no.- 
. ihacMve redundancy , in. the aircraft=. and 911.;^^^^ other , 
hand'isaf ety and. reliability .arev^substantially-igreater , 
^ than Vrwith .single -channel control.- . - V^^ V .if. '-,., 

■ An:- embodiment of thei,invention., will now be • ; 
described with reference, to theL aqcompanying drawings.,/ 
in which:'- ; • • , • ' r. . ;rii * . . 

:^Fig. 1 shows a partial circuit-./ diagram for a 
preferred embodiment of : the invention with a 
control device for switching over* the engine 
control and for freezing the supply of fuel; and 

Fig. 2 shows a partial circuit diagram for a 
preferred embodiment of the invention with a 
control device for blocking the supply of fuel in 
the case of shaft fracture, excessive rotational 
speed or other serious engine defects. 

Fig. 1 shows a partial circuit diagram for a 
preferred embodiment of the invention with a control 
device for switching over the engine control and for 
freezing the supply of fuel to a shaft drive assembly, 
having at least one micro control device or processor 1 
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for controlling the metering of fuel by means of a 
metering valve 10, controlled by a motor drive 8 via 
several signal -select ion logic blocks 4, 5, 6, 7, and 
22 in Fig. 2, such as a channel switch-over logic G, 
two freezing logic circuits 5, 7 and a channel switch- 
off logic 22, as indicated in Fig. 2/ with monitoring 
b& the engines for shaft fracture^ and Excessive 
i:^^^i^fc>t^iorial:*'^sE?eed by means of sensors V* :^*^^^-^':?^^^ - 
Ei>*V-: ^-ri :iThis eiiibbdiment makes' us'^e' df' Cw6 mi^dro -col^^ 
^i^evdciss : 1 and 2 V With which the^>iiMWrf ac^^^^ Vr > » 

r-s tapping motor for controlling' Vfuel supif)'4^-5r^^'and':f or 

the ""f ^st- cut-of f of a ^blocking vafvW; such ai*^^<5i^ ' - 
-^'ihistahce an emergency 'shutdown' valve" 23 S' ^sho^ Fig:^^' 
-■.^ i^fJtc& the -supply of f uel ^r^ alr^ady^'ittstaO-ie^." . 

- The outputs of the micro control 'devices -i anc^-'aV ' 
vnaitiely Ap^i-ojr Ap^, for f reezing^'the: fuel ^dapplyj' Api or"^- 
- Ai;^ fdr free-zing the f uei -supi^^ly 'wheri^ marfunc'tion of 
^ 'the -siensor* technology or" df the 'niicrb 'control Hevices'?'^- 
is- identified in the case of- an error in both -fehanriels , 
:-Asi or'As2 for the selection of one of tSe -micro" control 
■--devices as the regulator of tiie fueT isuppiy, and Agoci or 
' ^soc3 in Fig. 2 for a fast cut-off of 'tife fuel supply in 
"'the case of shaft fracture or excessiv^^ Rotational 
'speed, are conveyed by means of power '^^end stages Tp^^ 
and Tp,2, Tp^ and Tpj, and Ts2, and Tsoci and Tsoc2 

respectively in Fig. 2 into the signal -selection- logic 
5, 6, 7 as shown in Fig.l and 22 in Fig, 2. 
Accordingly, a first and a second micro control device 
1, 2 are coupled together and locked in partial 
functions with respect to each other. 

The first micro control device 1 as the selected 
control device controls, for instance, a stepping motor 
8 which drives the metering valve 10. The selection of 
the micro control device 1 is effected via the switch- 
over block with the selection logic 6 by the relay SI 
which is assigned to an output A^^ of the micro control 
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device 1 or by the relay S2 which is assigned to an 
output of the micro control device 2. The relays SI 
and S2 are locked with respect to each other and 
coupled in such a way that the following logic is 
•5 ; . reliably achieved for the channels Kl and K2 : 

1.. channel Kl selected AND. channel K2 off : 

- - 2. channel Kl off . AND .channel K2 selected; 
T^-r^jCi^H^;;^*-^- 3.'-' channel Kl off.; ANPvcharmel^:K2 off; v . 
\ v.:V^rv Kvij:^ case. 3 . is- only activated when feoth; mi^ control,. 

- 3:gv>^j^^- sysfemsrhave.. a total failure v. 5:,:En this;* q^js^^ both 

or- Ap2 are set -at.^error ppt^enti^l . and^- 1^ -x-.- . 
,i-,:?^e3,ays Fl /and F2 drop -away: so , that the as^.o^ciated- 
^>^ii;''ij'd^,Q^j^^s^QX:,Q F^ . pr Fj in the . logic* vnipde 7../setv^'Oiie-^of -..the^ . 
^ ..:. L^. . v:^^^^^^^^ of -the ^stepping ^mp.t92:<:j.8vto ;:a ,-f 

^ 15\ ;:lpQtential Vp and hence freeze, the posit ion the;; >, :.: 
•ov risteppingimptor 8, the. position of . the. , metering yaiye. 10 
j J . : arid -thev.amount of fuel: supplied.,, i.e. , the,., fuel supply 
-'^ ^ ^^ither. increased nor decreased. . . . .^ ? n ^ :>^:,,v 

V • For controlling, the stepping motor B^the channels^. 

20.-. f : Kl and K2 have in this instance,, four, phases Ph^, Pha, 
v--> . " ; Phj, Ph^ on the supply lines to. ^the. stepping motor, one 

- v' yi- ' of the phases being channelled .through a first 

^. f , selection or relay logic 5 for freezing the current 
'T^:' fuel supply. This logic 5 ensures^; that in the case of 

25 an error hot identified by the selected channel, the 

non-selected channel may prevent a critical error 
function for the shaft power drive assembly. Freezing 
is effected by one of the four phases here Ph^, being 
set to the already mentioned fixed potential Vp, which 
30 in this example is between 12 and 48 V, with 28V being 

selected here. 

Consequently the second micro control device 2, 
which in this case is connected as the auxiliary 
control device, can monitor the permitted boundary data 
• 35 of the engine and for this purpose is equipped with the 

driver outputs Agj* Apj* Apz2 shown in Fig.l and ^soc2 
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Fig. 2. 

For the sake of completeness, a manual emergency 
control device 9, already known for devices of this 
kind, has been integrated into the preferred exemplary 
5 embodiment of Fig. 1, and makes it possible for the 

' ' ■ operator to switch over to manual operation- At the 
5vt.:.c same time this is an example of how the . ccjntrol device 
>Uy> '''t;h^ invention can ie ihtegratediitbi^advattt^^ into I r 

V " ^ •v^^^Vej^igtihg lrifet?allatiori^ and^ regulation conibept^l ^' V'^^/^r:v 
•rib 'i^'^^ Jir:"'-^ Fig^'-' 2" shbws a .partial ''■circuit * dia^am ^r v^ :;v;' 

V ; ?rV>v^if§fi^rired embodiment '^6f the invent ion/- '^wi'feh ^a;-: control- 

• ? S d^vl%^r;':f or ''blocking, the supply^ of ' fuel' \^ -Mh^r case ' of i^i- 
j ''^r's^^t^Af racturev '^xcessive'^ rotational^ sp^feci^i^^ "J. vr 

r'^'''^-' .■•:^?::s&jr5k>xi^ erigirf^ ^defects ^^oi' tthi^ purpose ;lanrt^ 
■ 115 shut-down 'iralVe 23 for * the fuel'^is ■ alctuated;-^?^^ •'l./V-i- 

' cdnti-ol f bir the emergency ' shxitdoim valvfe- 2^^^ deS;iGined 
. ' - ^ . so.jstJha't; fe'hW -micro control device /not selec,te<i$ fjor 

..r-t. V - ^cbnlirol df>''t-he stepping motor monitbirs^ the; ro^ationari^* 
? ' . speeds meaisUf'ed by the sensors for shaft fracture and ^ 

-2 0 - - • : fexce ss i ve rot at ional speed ih-'a short icyc.le df about ' 
r^-y'^-'}': ' iy\S^X:o about 6 ms, in 'this example ; 2'c rns . ! ?If '-^'this type 
. faulty functioning of the' engine-lLs' identified, this 
r:^" • " ^ second micro control device sets its^biitput Asoc2 and by 
"i^^f " ' means of the data signal line Ijj. causes an interruption 
25 " in the running of the control procedure for controlling 
the fuel supply in the first micro control device. 
This device in turn, somewhat delayed (about 0.5 ms) , 
also carries out this test for shaft fracture, for 
instance, and accordingly controls its own output Asoci- 
30 When both micro control devices 1 and 2 have set their 

outputs Asoci and Asoc2 ^.he emergency cut-off is activated 
by means of the relay logic 22. Mistaken emergency 
cut-off of the engine due to an electrical malfunction 
is therefore extremely unlikely. 
3 5 If one of the two micro control devices 1 or 2 

fails, the contact of the associated relay Fl or F2 is 
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closed amd the entire authority via the emergency 
shutdown valve 23 is transmitted to the error-free 
micro control device 2 or 1 . 

In the case where both micro control devices 1 and 
15.. 2 fail, both F-relays are closed (fall away) and the 

~ /, emergency cut-off relay SOC can no .longer be 

-controlled. The likelihood of ;the,.coincidence. of .a 
-Vr^.y^^^^^^^^ error in the device andC a;, fr^^ the shrift v 

; ■i^.^,^^^ v^;^,4:srpractic:ally -zero. :\ ^f - ^* ' ^-vr.^s v-/,?;-:>v/ 
''iLO^ j^p i-v The . embodiment- aQCording;.,to Eig,:. ^^^^^ assumes .two ,j .r, . 
• *v :./-;f>i!^tV^ '^^ngines/yit shafts independent ..o£,,each;,. ,pjther . ^ ...The.,..;-. 
r...- .fc<idoj;^daish/^Line is intended to ,indic;at^ t^e^i^terf ^e, 

. . .Jf' o'%iwitii the' second .engine with a second/ e^^^^ 
: v:.:: :^' -^H^;- ^alve . ,2 ^. A^v^ By ..control ling , the, emerg^nc^ ,.cut^off 
:-v i5.:. '[^.i -^^OC f iris t. of all. the emergency ..cut -p-ff -pX^^^^ secon^d 

-V enginie^ is ..locked and .-then .the emergency : cut -off. of the 
v. .-^irstH^engin^ is trigge?-ed. . Safety. an4 re^^^ 

: . - -therefore, increased: b.e^cause/. the, .following^3,s.^^ .: 
. ■ .;requirements are guaranteed: . : - ^ .vv^^'-^^-v • 

20- 1- When one .engine, is switched, the second 

y engine can-: no .longer;. be switched off; 

.r:::U : . 2 . With simultaneous triggering of the switch- 

? off both engines, neither 'of them may be 

>rjvifv*- switched off. -a^- 

■25 The downstream bistable relay 20 means that once 

started an emergency switch-off can only be reset by 
the flight personnel. 

Control of the two micro control devices is 
effected in two different modes. The first micro 
30 control device 1 selected for control of the engine 

runs the control programme which is responsible for 
control of the stepping motor 8, in one mode at a cycle 
or period of about 20 to 100 milliseconds, in this 
example 50 ms. The second non-selected micro control 
35 device 2, used for monitoring the characteristic data 

of the engine, runs the control of the monitoring, for 
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instance for shaft fracture and excessive rotational 
speed, in one mode at a cycle or period of 0.5 to 6 ms. 
In addition, monitoring of the engine operating point 
is effected as a backgroiind. 
5 On identifying the shaft fracture the output Asoc2 

is immediately set and at the same time the first micro 
- V. control device is interrupted by means-. -of the data 

■signal^^-^rine- Ijr in the running of tbeV'-iritendeci iuer"''5- 
. ^"^^.--^'V. supply <regulat ion i- - - ' ^s^ -^ii.^. 

■ 'iM^^^ 4^ 'i: Wheri'-^ the engine has - reached ah ^cnperm 

,;J^av^^J^ iQpe^at-in^'^'pdint':,. such as excessive rotatidnal speed>^^^^^ ^- 
/"'l /E^tehen f i-r^t- of all in this texample- thW. outp^^ 
':^V ^^'^7;*seebnd. rriibrb^cbhtrol device is set . v-^:In^fe:&e ^^ase 
- - ^y- excess iye^^^^^^ if excessive.- rbtational-:^ 

15 ■ .- speed -stxli' applies a few milliseconds later, artci>-t&ls, 
. <5 Ij^s beteriv cpnf irmed 3 -to- 6 .'-fold, the *6utputHAsoc2-^with-. 

V . . fespciafeed (emergency swi 
- ' . ; This;, division of ^Gontrdl' in- accordance v^^^ 

.invention- -means that-.' it - is -possible, with ^irelatively - ■ 
20: V low expenditure on -.har:dware; both to control the engine 
* ' ' r' With short idling time.iandvto carry- but effective 

^ (r-^' monitoring* of shaft fracture and excessive rotational 

speed. 
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Claims 

1. A control system for a shaft drive assembly, 
including: 

a pair of micro control devices (1,2) for 
controlling the metering of fuel;, and 

meauis for monitoring the. /drive assembly for shaft 
fracture and/or excessive rot atdonal speed ; 

■'r-^- ^viri which one of the micro' :Goht to acts-, 
as • thW-' selected -control device controlling the:;;fuel . 
metering; and- the.. others micro bpnj-r.ol device ^i^(2) .acts^^^^^ 
as =an . -auxiliary- control:: device mpnsutoring the. ;<:riti^ 
'data^.pf -the" drive rasse and, is egud;pped yi,th ..pu^ 

(^2 Ap^jO y.fbr'i freezing the fAier:*setting^ f or^^one ; : .^iw; 

kind'ibf..>f ault^ or tri'ggeringr.arcut-of f ff or anp-ther::/., morer... 
seVipus; kind of : fault/ the- selected , and the-^al^xiliairy 
control device .'(1^ -^ 2') -being coupiedy together ';in ;^s a 
waV 'that the functions « can be alternat^ely sy^itched oyer,., 
bdtwi^err the twp>c6ntrol devicies ^ : '^^ %^ wt:.^ v 

'2 -: A control' system according t<5 claim^''l.;and 
further! Including/ if irst. and^ second ,,.logic switches- ■ (5 , ; 
22), in which the.ifir^t switch. r( 5) mediates the output 
for freezing the fuel sett ing^- and, by means of a 
transistor driver (Tsoci' . Tsoc2) V the second logic switch 

(22) triggers the fast cut -offhand makes possible a 
delayed cut-off by means of the second logic switch 

(22) , and in which the functions are switched over 
according to the setting of the first and second logic 
switches (5, 22) . 

3 . A control system according to claim 1 or 2 , 
in which the control devices are coupled together by 
means of the first and second logic switches (5,22) and 
an additional direct data line (I21/ I12) • 

4. A control system according to any preceding 
claim,, in which the fast cut-off is triggered by the 
auxiliary control device and is effected by the 
selected control device. 
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5 . A control system according to any preceding 
claim, in which both micro control devices (1, 2) can 
fulfil all the functions as individual devices when 
there is a total failure of one control device , but the 
monitoring function for shaft fracture in this case is 
carried out slowed down by a factor of 3 to 10. 

6 . A control system according to. any preceding 
claimp ;4n whichx the. pontrol - is ef fected withA a vmain " •* * - 
cyclevatv;^ period. of 20,i to 100 milliseconds and^-r.w-i ■/ ? . 
with ^^;: ?iJLb.rTcyc.les: at/, ai-peripd^ tii> qfc^ .to 25 a?i l y. 

-milliseQpnds :-. ^>v;. ' -4 

3^ ' : : '^ control :<^ystem >accordingcrtQ;t: claim £ if.:iti - 
-.which : the; vshaf t. f ra^sture, monitoring {is^/jcarried ;pUt;^i^^ a 
'^^^'SYSM-^^^^^'-^ ito: tR/lO>,,.>^.C.;;^i: ^-^ VA;-:^^V^^VV. 

according ^to^ claim- :6ipr 7/ " 

in .\9{hich,. the rotationial vspeed' is-.^^ within, a 

.^b-cyc;ie of period -tR/^ 2tR with. 3-tp:--5 fold- A . 

confi^ation. . i v^-itV ' ■ ■ ^ •■];> - - \^<^,0v: * 

.v> .:9-.:;,.,- A. control rsys.tem according - to;t any .preceding ^ 

claim, in which: 4:he.;.cpnt.rpl device ficontrols the fuel by 

means of a metering .valine with: a. steppiiig motor drive 

and by means of channel cut-off logic. 

10. A control system according to claim 9, in 
which the stepping motor (8) is operated by means of 
four-phase supply lines (P^x/ Ph2/ Pha* Ph*) which are 
controlled by means of a driver (3, 4) and four-pole 
switching (6) selectively by the first or second micro 
control device when a selection signal is present at 
their outputs (Asi^ As2) . 

11. A control system according, to claim 10, in 
which freezing of the position of the stepping motor 
and hence of the position of the metering valve is 
effected by applying a stop voltage of 12 to 48 V at 
one of the phase supply lines (P^.^,, P^^, P^, P^J of the 
stepping motor (8) by means of relay contacts (F^^, F^) 
in the first logic switch (5) . 
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12. A control system according to claim 10 or 11, 
in which an error signal at one of the outputs (Ap^, Apj) 
of the micro control devices (1, 2) causes freezing of 
the position of the stepping motor and hence the 
position of the metering valve by applying a stop 
voltage of 12 to 48 V at one of the phase- supply lines 
(Phi, Ph2; Ph*) of the stepping motor (8) hy means of 

-relays cont ate ts (Fj, F^) in a tiiird-'logic swit^^ (7.) . : 
''^''^i^'^'^^i^-: -"A control' systeni*' accbrdihg' to any -preceding- 
blaiim/' in "Which in^ -the^ case o5rfa^f ast . cutVpCf- ' ; 

-sh^ft-^' fracture the non- selected .'second- micro control v 
device: (2) / kctirig -as' an auxiliary- :*:ohtrol. deyice, 
inti^rrupts the selected f irst 'micVo=»^6ntr:pl ; deyrce in. -:^ 
its 'itnain cyclfr by^-meaihs of a signal ••clihe laiivv,^ and " V'-*^ 
•:swi tches' it over to- shaft f racturel .test mode:;.: and after 
'^iidependent testing- by the first" micro control . device ..-^ 
*^Uy -and confirmation, an output signar/' (Agoci)' 5at- the i 
first micro control device (1), via the second logic ' , 
switch (22) , switches 'of f the drive -assembly-* by 
blocking the -fuel metering valve;= ... " • > ' 

14. A cdntr6i'>'sy St em 'according to any preceding .> 
claim, in which the first and second micro control 
devices (1,2) are joined together and locked, with 
respect to each other in partial functions. 

15. A system or method for controlling a shaft 
drive by means of two equivalent micro control devices, 
one for carrying out the routine control of the fuel 
metering and one for the monitoring of faults, the 
latter applying suitable override functions when 
certain faults are detected, in which the two micro 
control devices are adapted to be interchsmgeadDle so 
that the control function can be performed by the 
former monitoring device and vice versa . 

16. A system or method for controlling a shaft 
drive by means of two ecjuivalent micro control devices, 
one for carrying out the routine control of the fuel 
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metering and one for the monitoring of faults, the 
latter applying suitable override functions when 
certain faults are detected, in which both micro 
control devices are capable of performing both the 
5 control and the .monitoring so that in the case of 

failure of one^ device the other can maintain control 
r;-:. "4 . .. and monitoring intact . . tv . . • . * 

• ,:Vv- -V^^vv :tdescribe^:* h^irein . with' r.ef erence ; to- the:^:?accomp'ariyinig K-^i -^ : . *'U' : * 
/^?1^0,^,.. . dr^w4^ng;S>;^^*';.vv>-"i V^/f'^r^ v-". ' -^Mr^^^-'i-^ -i^' •^^^^^'^<V^'* ; \ - : -^i -r'^-'r: 

^.^^'-^-^vJfe^v- A? . f v--;l8^^V:^T-A turbine- :jenginev includingvrar. control,;' s^ \'^^ • 

" i .^i; .;vas : <:3^aiine^ claiiti^: J'^x . ■• =*. --Te- ^Af*i^r:5=^ 
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